kvcache-ai Mooncake vulnerabilities

Newest CVEs

• CVE-2026-106041

  Mooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC

  kvcache-ai · Mooncake

  Medium6.9
• CVE-2026-106040

  Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC

  kvcache-ai · Mooncake

  High8.8
• CVE-2026-106039

  Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC

  kvcache-ai · Mooncake

  Medium6.9
• CVE-2026-106038

  Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs

  kvcache-ai · Mooncake

  High8.8
• CVE-2026-106037

  Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service

  kvcache-ai · Mooncake

  Critical9.3
• CVE-2026-104433

  Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString

  kvcache-ai · Mooncake

  High8.7
• CVE-2026-103765

  Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server

  kvcache-ai · Mooncake

  High8.8
• CVE-2026-103764

  Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport

  kvcache-ai · Mooncake

  Critical9.3
• CVE-2026-103761

  Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue

  kvcache-ai · Mooncake

  High8.7
• CVE-2026-103760

  Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write

  kvcache-ai · Mooncake

  High8.2